Merge the IDA Code Mode port

Replaces the private idalib worker (idatui/worker.py + worker_client.py, with
server/patch_server.py injecting tools into ida-pro-mcp) with an ordinary
client of ida_codemode.client.DatabaseHandle. A database open by an IDA GUI is
reused; otherwise Code Mode starts or shares a managed idalib worker. The TUI
no longer owns an IDA process, and closing it releases only its lease.

Based on Duncan Ogilvie's port, rebased onto ~150 commits of local work it
predated. The rebase itself was mechanical; landing it was not. Nine defects
had to be fixed before the feature set was whole again, none of which the
patch's own tests could catch:

  - DatabaseHandle.open() takes image_base, not loading_address: every
    connect() would have raised TypeError on the first call
  - five operations our tree had grown were simply missing (flowchart, so the
    graph view was dead; op_format/pc_nums/pc_num_format, so 'o'/'O' were;
    survey_binary)
  - set_comments wrote only the disassembly comment, so comments never
    appeared in pseudocode
  - xref_query returned rows in raw IDA order, and 'follow the call' silently
    followed the fall-through instead
  - rename accepted one edit per category, so bulk symbol import was dead
  - decompile ran decomp_map's full per-column ctree sweep to fill in a
    per-line address anchor
  - heads shipped without operand extents or the digest protocol
  - the package became unimportable without ida_codemode installed, which
    killed the offline test suites

Verified against the pre-codemode tag rather than against assumptions: the
full suite is 788 passed / 0 failed, and the pilot's 301 checks match the old
backend exactly. Performance is within 2x on the listing hot path and faster
on decompile, disasm and connect, after fixing two runtime costs that are
documented for upstream in docs/CODEMODE_UPSTREAM.md.

Test runtime came down from ~9m20s to 115s along the way -- not by removing
checks, but by removing four kinds of waiting-on-a-guess that were also
hiding real failures.

1 files changed, 21 insertions, 7 deletions

diff --git a/idatui/project.py b/idatui/project.py
index e2fc542..53f3b0a 100644
--- a/idatui/project.py
+++ b/idatui/project.py
@@ -23,7 +23,8 @@ firmware image, a cleaned build tree).
 A source whose size/mtime no longer matches the staged copy is re-staged, and its
 now-stale database is dropped (the DB describes the old bytes).
 
-stdlib-only, like the domain/worker layers — the TUI is the only Textual consumer.
+The model has no IDA imports. Staging consults ida_codemode's registry before
+replacing files so it never mutates a database owned by a GUI/shared worker.
 """
 from __future__ import annotations
 
@@ -56,7 +57,7 @@ class BinaryRef:
     #: it is, a raw firmware image doesn't, and IDA defaults to metapc at 0.
     processor: str = ""   # IDA processor name: arm, armb, mipsb, metapc, …
     base: int = 0         # load address (natural, e.g. 0x8000000)
-    ida_args: str = ""    # escape hatch: extra IDA command-line switches
+    ida_args: str = ""    # legacy -p/-b/-T switches accepted by Code Mode adapter
 
     @property
     def db(self) -> str:
@@ -310,13 +311,25 @@ class Project:
         """Ensure ``ref`` is staged in the sidecar; returns the staged path.
 
         Re-staging a changed source drops its database: the DB describes the old
-        bytes, so keeping it would silently mismatch the disassembly (any renames
-        in it are lost, which is why callers should say so out loud).
+        bytes. Refuse while Code Mode reports a GUI/idalib owner; replacing a
+        staged executable or IDB underneath a shared live instance is corruption.
         """
         if not os.path.isfile(ref.source):
             raise ProjectError(f"no such binary: {ref.source}")
         if not self.is_stale(ref):
             return ref.staged
+        try:
+            from .codemode_client import database_owner
+            owner = database_owner(ref.db, ref.staged)
+        except Exception as exc:
+            raise ProjectError(
+                f"cannot verify Code Mode ownership before staging {ref.label}: {exc}"
+            ) from exc
+        if owner is not None:
+            raise ProjectError(
+                f"cannot restage {ref.label}: Code Mode instance {owner.record_id} "
+                f"still owns {owner.idb_path}; close/release it first"
+            )
         os.makedirs(self.bin_dir, exist_ok=True)
         tmp = ref.staged + ".staging"
         _unlink(tmp)
@@ -338,10 +351,11 @@ class Project:
         return out
 
     def sweep_scratch(self, ref: BinaryRef) -> int:
-        """Delete IDA's unpacked working files (never the ``.i64``) for ``ref``.
+        """Delete unpacked working files (never the ``.i64``) for maintenance.
 
-        A hard-killed worker leaves them behind and the database then refuses to
-        reopen. Only safe when no worker holds it.
+        Runtime paths no longer call this: Code Mode instances are shared, so a
+        registry owner may still be using these files. Callers must independently
+        prove that no GUI/idalib instance owns the database.
         """
         return sum(1 for suf in SCRATCH_SUFFIXES if _unlink(ref.staged + suf))